802.1x on Aironet 600

[OMAR MASRI]

On an AIRONET 600 AP (officeExtend) with the remote LAN interface is configured to use 802.1x authentication:

If a Cisco IP Phone is connected, 801.x authentication challenges for credentials. The AP does not seem to have a way to detect that this is an IP Phone and to skip the challenge (as Cisco switches/routers would do) -

Is there any way around this? Can the remote LAN interface be configured to skip authentication for IP Phone and only authenticate PCs etc..?

[Amjad Abdullah]

Salam Omar,

What port that is configured for dot1x authentication? The switch port to which the AP is connected?

Rating useful replies is more useful than saying "Thank you"

[OMAR MASRI]

HI

The "remote LAN" port (port 4 - yellow) on the AP 600 is configured for 802.1x - this is done on the WLC.

Thanks

Omar

[Amjad Abdullah]

Omar:

Usually with Cisco switches if you use dot1x auth for ip phones that are not dot1x-capable, you use MAB (MAC Authentication Bypass) and provide the mac address of the phone to the ACS server so it return access-accept radius packet if the mac address is listed.

Now, elaborate more about your situation, you have the mac address of the phone on the ACS and it does not work?
If not, you need to add a MAB entries for the mac addresses on the ACS (or whatever RADIUS server you use) and tell it if no dot1x auth started then allow those mac addresses if they try to connect.

If that is already configured and still does not work some more investigation is needed.

Regards,

Amjad

Rating useful replies is more useful than saying "Thank you"

[OMAR MASRI]

I guess what I'm trying to find out is if it is possible to bypass the  802.1x process entirely if an IP Phone is connected. I'm not sure this  is possible.

[George Stefanick]

I looked at this very issue myself. The ap600 / wlc doesn't support MAB.

However, if you have ISE I'm told it will extend to OE aps and mab can be used / managed by ISE.

Sent from Cisco Technical Support iPhone App